1

I have read multiple articles on spiceworks about MFA /2factor authentication for office365.

I am looking to enable it for my end users.

My reasons why?

  1. If they were to be phished and they were to provide there credentials to a office365 look alike login screen then at least with the dual-factor piece in place nobody is getting into their account.
  2. If they had overlapping username/passwords with another account (we know that never happens right). Then if someone tries to login to their webmail through the office365 page they would be presented with the 2nd authentication step.

What i am struggling with is where the “app” password that comes up is helpful. Is this app password that is something that will need to be updated everytime that their domain password is changed?

We are using AD Sync -

If the app password is used to allow (outlook access) as well as (mobile access) what is the best way to get my end users to obtain that password? I am wanting to simplify roll out.

Can 2-factor be enabled but not require there be app passwords?

3 Spice ups
2

App passwords are a “fallback” type of scenario, and are intended to be used with any applications that do NOT support MFA/Modern auth. In other words, using app passwords BYPASSES MFA, so is less secure. They are not tied in to the on-premises or O365 password in any way. Moreover, you can have multiple app passwords configured, and they never expire. It’s a crap solution that should be a thing of the past now that all Microsoft apps and some 3rd party apps support Modern auth. My advise is to disable them, if possible of course.

More info here: Configure Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn

2 Spice ups
3

Agree with Vasil, avoid app passwords if able. Note that Office 2013 (fully patched) and newer Office apps support modern authentication so do not need app passwords, but many third party apps (including iOS Mail and Android stock Mail apps) do NOT support modern authentication so would have to use app passwords. If you’ve had Office 365 tenant for a while you may need to manually enable modern authentication first.

We use latest Office ProPlus on computers and have our users download the free Outlook app for mobile devices to avoid needing app passwords at all. However some insist on using the stock Mail apps and refuse Outlook so have to use in those cases. Also those annoying Samsung watches a couple of users have that don’t seem to work well with anything Microsoft need them.

4

I followed your link and I get what your saying but (Can app passwords be turned off?)

I enabled 2 factor authentication for a few users and then right away outlook installed on the local machine prompts for authentication their mobile device.

So enable trusted ip ranges in office365?

5

Jacob,

We turned on MFA and right away a patched and updated version off outlook 2016 prompted for the app password. Again trying to figure out how to turn that off.

6
  • 1 On disabling app passwords.

BUT, Skype for Business requires an app password so we are forced to use them.

I think almost all if not all versions of Android mail lack MFA capabilities, while I would use the Outlook for Android app instead some people might insist on using the built in mail. I have no idea what your environment looks like but that was a gotcha moment for me.

You can create new app passwords by going to the the user account in a web-browser, click the user icon in the top-right and then “My Account.”

Under Security and Privacy there is a tab called “Additional security verification.” In there you can manage your app passwords.

Users should be able to see this so you can send them there if they need an app password rather than trying to get them to not click through the setup.

Hope this helps and good luck.

7

It should only ask once or twice (sometimes OneDrive asks separate from Outlook and others) per device, so isn’t a problem for our users. Depending on your subscription, you may be able to configure conditional access policies to prevent prompting for two-factor from local network IP, but most Office 365 plans do not support this natively. It requires Azure AD Premium Plan 1 or better, or plans that include it such as Enterprise Mobility and Security. Again not an issue for our users since they are only prompted shortly after initial setup then it trusts their work device.

Outlook should not ask for app password, but rather a one-time code from phone call or text (or “Approve” from Authenticator app). If it is only asking for password but not prompting for two-factor, you may need to check your modern authentication is enabled for your Exchange Online PowerShell, but it does not sound like that is the issue.

Modern Authentication should already be enabled by default in new and existing Skype for Business online tenants; we have not had any issues there.

8

thanks for the update Jacob… I assume you will still face the same issue with mobile devices unless they are using the Office 365 app correct?

I then wonder if its worth the hassle.

I don’t know why Microsoft could not enable 2-factor for the (web) version of office365 but installed apps leave be.

I don’t mind going through the steps of setting it up even if its walking through the steps with my end users if its a (one time deal) but if its going to change their behaviors with the mobile devices on top of that. Its a pitfall for me.

I am really after just putting a second authentication method in place for the OWA which would be more than likely the way a users account was compromised in a phishing exercise.

Are there other way to accomplish this?

9

App Passwords come into play when your using older versions of Outlook installed on the PC. I believe 2016 has MFA built in.

10

Hey Austin,

I have my laptop and the CFO’s laptop which is running office 2016 - see screenshot and they prompted for the app passwordversion.jpg.

11

If you want to force MFA for only specific apps (such as OWA), using Conditional Access policies is the way to go. And you can also use CA policies to block legacy auth across the board now, making things more secure.